1

If I'm logged in as $USER, and I run top and I can see a process I own can I rename that process?

If so, how? If not, can root rename a foreign process? If so, how? If not, why?

1

It depends what you mean by “rename”. Processes don't have names as such. Processes have a command line. The command line need not be preserved after the program starts. All Unix variants do keep a copy of the command line, but it may be truncated or otherwise modified (e.g. running arguments together with spaces in between, so that foo 'hello world' is not distinguishable from foo hello world).

Most Unix variants allow a process to modify the command line that ps shows, by modifying the content of the argv parameter of the main function. You can only overwrite the buffer in place, so it may not be possible to make the buffer longer, but it can always be made shorter (each argument ends at the first null byte).

From the outside of the process, you can run a debugger and edit the program's argv. Here's a demonstration under Linux with GDB.

$ sleep 999999.00000000000000000000000000000000000000000000000 &
[1] 2131
$ ps 2131
  PID TTY      STAT   TIME COMMAND
 2131 pts/8    S      0:00 sleep 999999.0000000000000000000000000000000000000000
$ gdb -pid 2131
…
(gdb) bt
#0  0x00007fa1206286e0 in __nanosleep_nocancel ()
    at ../sysdeps/unix/syscall-template.S:81
#1  0x0000000000403f3f in ?? ()
#2  0x0000000000403d58 in ?? ()
#3  0x00000000004016c9 in ?? ()
#4  0x00007fa120592b45 in __libc_start_main (main=0x401540, argc=2, 
    argv=0x7fffc8b1bf18, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffc8b1bf08) at libc-start.c:287
#5  0x00000000004017d5 in ?? ()
(gdb) frame 4
#4  0x00007fa120592b45 in __libc_start_main (main=0x401540, argc=2, 
    argv=0x7fffc8b1bf18, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffc8b1bf08) at libc-start.c:287
(gdb) p argv
$1 = (char **) 0x7fffc8b1bf18
(gdb) p argv[0]
$2 = 0x7fffc8b1d27e "sleep"
(gdb) p argv[1]
$3 = 0x7fffc8b1d284 "999999.", '0' <repeats 47 times>
(gdb) argv[1][9] = 'z'
Undefined command: "argv".  Try "help".
(gdb) p argv[1]
$4 = 0x7fffc8b1d284 "999999.00z", '0' <repeats 44 times>
(gdb) detach
Detaching from program: /bin/sleep, process 2131
(gdb) quit
$ ps 2131
  PID TTY      STAT   TIME COMMAND
 2131 pts/8    t      0:00 sleep 999999.00z0000000000000000000000000000000000000

Depending on how your system is configured, you may or may not be able to run a debugger on a program that wasn't started by the debugger, and you will not be able to run a debugger on a program that isn't running as your user with no extra privileges (except by running the debugger as root). This is controlled by the permission to use the ptrace system call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.